The scam text looks like your bank. The voice on the phone sounds exactly like your daughter. The video call features your boss’s face, asking you to approve an urgent transfer. In 2026, the tools that once made digital banking convenient have become the weapons of a new generation of fraudsters—and they are winning more often than you think.
The numbers are sobering. Attempted banking scams surged 35% over the past 12 months, according to BioCatch’s 2026 Global Scams report, which draws on data from more than 370 financial institutions across 21 countries . A staggering 90% of all scam sessions now originate on mobile devices, up from 85% the year before . And the financial toll is staggering: global scam losses reached $442 billion** in the past year, with investment scams alone averaging **$6,600 per case—five times higher than the average across all scam types .
What makes 2026 different is the role of artificial intelligence. “AI has lowered the barrier to entry for aspiring scammers,” says Thomas Peacock, Director of Global Fraud Intelligence at BioCatch, “allowing more bad actors to create more convincing scams at a scale we’ve never seen before” . Deepfake-enabled financial fraud has grown into a $40 billion annual market, with video synthesis accounting for 42.7% of observed cases and audio-based voice cloning for 21.9% . The most common scam type is no longer a phishing email. It is authorised push payment fraud—where you are manipulated into transferring money yourself, believing the request is legitimate .
The good news is that most of these attacks can be stopped with a handful of practical habits. Here are 10 ways to protect your money in an era of smarter digital banking scams.
1. Never Trust a Link in an Unexpected Text or Email
Smishing—scam text messages—remains the highest-volume tactic, with fake “unpaid toll” demands, missed-delivery notices, and “bank refund” texts designed to funnel you to lookalike pages that harvest card details and one-time codes .
What to do: Treat every link in an unexpected message as hostile. Do not click, tap, or scan. Instead, reach the organisation yourself using a number, app, or website you already trust. If the message claims to be from your bank, open your banking app directly or call the number on the back of your card .
2. Verify Any Urgent Money Request Through a Separate Channel
Voice-cloned “family emergency” calls, deepfake “celebrity” investment ads, and deepfake video calls impersonating a CEO to authorise a transfer are all in active circulation . Seeing or hearing someone is no longer proof that it is them.
What to do: If you receive an urgent request for money—from a family member, your boss, or your bank—end the conversation and verify through a separate, known channel. Call the person back on a number you already have. If it is a work request, confirm it through your internal messaging system or a direct call to a known colleague .
3. Remember That a Real Bank Will Never Ask You to Move Money to a “Safe Account”
One of the most persistent and devastating scams is the “safe account” call—someone posing as your bank or the police, telling you your funds are at risk and you need to transfer them to a “safe account” for protection. A genuine bank will never ask you to move money to protect it .
What to do: Hang up immediately. Do not confirm any transactions or share any codes. Call your bank directly using the official number on your card or statement .
4. Never Share a One-Time Passcode With Anyone
Your bank will never ask for your online banking password, full login credentials, or a one-time authentication code . Yet scammers routinely trick victims into reading out the code that would otherwise protect them—often while posing as a bank agent helping with a “fraud alert” .
What to do: Treat your OTP like the key to your account. Never share it with anyone who contacts you, regardless of how convincing they sound or what they claim to be. If someone asks for it, the call is a scam .
5. Use Phishing-Resistant Multi-Factor Authentication Everywhere
Standard SMS-based two-factor authentication is better than nothing, but it can be defeated by SIM-swap attacks and interception. Phishing-resistant MFA—such as passkeys, hardware security keys, or authenticator apps that use cryptographic verification—is significantly harder for scammers to bypass .
What to do: Enable passkeys or an authenticator app wherever your bank offers it. If your bank still relies on SMS codes, consider switching to one that supports stronger authentication. And use a password manager to generate and store unique passwords for every account .
6. Be Skeptical of QR Codes and Lookalike Domains
CISA has warned of phishing campaigns that use malicious QR codes and device-linking to hijack messaging apps and accounts . Fraudsters also register lookalike domains that mimic your bank’s help desk, designed to pass a quick glance .
What to do: Do not scan QR codes from unsolicited messages. Navigate to official websites directly by typing the address or using a bookmark. Check for secure connections (https://) before entering any personal data .
7. Turn On Real-Time Transaction Alerts and Monitor Your Accounts
AI-powered fraud detection is improving, but you are still the first line of defence. Real-time alerts can notify you of unusual activity before a scammer has time to complete a transfer .
What to do: Enable transaction alerts for your bank accounts and credit cards. Review your statements regularly—not just when something feels wrong. If you see a charge you do not recognise, report it immediately .
8. Protect Your Phone Like a Wallet
With 90% of scam sessions originating on mobile devices, your phone is now the primary target . SIM-swap attacks, malicious apps disguised as delivery notifications or government forms, and remote-access software are all vectors for fraud .
What to do: Enable a SIM lock or switch to an eSIM where possible. Do not install apps from outside official app stores. Keep your phone’s operating system and security software up to date. And be wary of anyone asking you to install remote-access software—no legitimate bank will ask you to do this .
9. Slow Down—Urgency Is the Scammer’s Greatest Weapon
Every scam relies on pressure. The fake fraud alert, the “urgent” transfer request, the limited-time investment opportunity—all are designed to bypass your critical thinking by creating a sense of crisis. The single most effective defence is to pause .
What to do: If a message or call demands immediate action, treat that as a red flag. Take a breath. Step away. Verify through a separate channel. The scammers are counting on you not to do any of those things.
10. Report Scams—and Watch for Recovery Scams
If you suspect you have been targeted or have lost money, report it to your bank and your national fraud service immediately . But beware of the second wave: recovery scams target people who have already lost money, with a stranger promising to recover your funds for a fee. That is almost always the same criminal network working the victim lists .
What to do: Report the original scam. Do not pay anyone who contacts you offering to recover your lost funds. Work only with your bank and official law enforcement channels.
Digital banking scams
are not becoming smarter because the criminals are geniuses. They are becoming smarter because AI has given them tools that were once the preserve of well-funded operations—voice cloning, deepfake video, automated phishing at scale—and because the shift to mobile banking has put the target in your pocket .
The defence is not a single app or a single setting. It is a set of habits: verify before you trust, slow down before you act, and never share the keys to your account with anyone who contacts you first. Your bank will not ask for your password. It will not ask you to move money to a “safe account”. It will not demand an OTP over the phone. If it does, it is not your bank.
The scams are getting smarter. Your habits can be smarter still.
